If there is no evidence, and they have stated that it wasn't them, anything else is malicious innuendo.
Google recently stated that the 5 million sets of Google account credentials were not stolen directly from them and only 20% of them were valid. Is this also 'unproven'?